Do I need to sanitize user input on an XData Client

BIZ TMS XData
4

For service operations you of course already see the values in the input parameters.

For Aurelius CRUD endpoints, you can use XData events like OnEnttyGet and OnEntityList:

https://doc.tmssoftware.com/biz/xdata/guide/events.html